About niketn

niketn · ‎12-26-2016

For transaction command to work, you would need to add transaction IDs to your events, this way there will be one time effort for logging however, query performance will be better (even stats can be used instead of transaction based on transaction ID). Seems like your current logs are being generated at periodic intervals and logs the Door status at that time. It does not seem to be based only on actual Door Open or Closed events. Because of which, there are multiple Open and Closed events together. Give following query a try, query is resetting Count using streamstats after every event where Door is Closed. SPL **accum command is used to generate cumulative Count. Based on the types of transaction scenarios provided, following are some of the cases to change the cumulative count to generate transaction IDs. 1) If the Door is Open and the Count = 1, then it is first event of the transaction. Increment the Transaction ID to be used for current transaction. 2) If the Door is Open and the Count >1, then the door is still open and has not been closed, then keep the same Transaction ID as the first Open status. 3) If the Door is Closed and Count > 1, then keep transaction ID same as first Open status. 4) If the Door is Closed and Count =1, then use the incremented Transaction ID as the is only event in the Transaction. 5) Default use the incremented Transaction ID. PS: You can change the case conditions here based on other scenarios/changes as per your requirements. <Your Base Search> | sort _time | streamstats count as Count reset_after="("Door==\"Closed\"")" | eval transID= 1 | accum transID | eval transID=case(Door=="Open" AND Count==1,transID,Door=="Closed" AND Count>1,transID-(Count-1),Door=="Open" AND Count>1,transID-(Count-1),Door=="Closed" AND Count=1,transID,1=1,transID) | table Count _time Door Temperature transID | stats count as EventCount first(_time) as StartTime first(Temperature) as StartTemp last(_time) as EndTime last(Temperature) as EndTemp values(Door) as DoorStatus by transID | eval duration=tostring(EndTime-StartTime,"duration") | eval tempChange=StartTemp-EndTemp | eval StartTime=strftime(StartTime,"%c") | eval EndTime=strftime(EndTime,"%c") | search EventCount>1 AND DoorStatus="Closed" AND DoorStatus="Open" | table transID EventCount DoorStatus duration tempChange PS: Final search with EventCount and DoorStatus can be used to identify various scenarios like Door Opened but Not Closed etc.

niketn · ‎12-26-2016

Kindly accept if this answer has helped you fix the issue.

niketn · ‎12-25-2016

Kindly update your question with your query which needs assistance... You eval expressions are missing comma before default case 1==1 expression. Also please choose appropriate default value since Others is not valid option for earliest or latest. Please find the snippet below: [| gentimes start=-1 | eval earliest=case($SearchOption$ == "Last_Working_Day" AND lower(strftime(now(),"%A"))="monday", "-3d@d", $SearchOption$ == "Last_Week_Same_Day_Time","-7d@d", $SearchOption$ == "Last_Working_Day","-1d@d") | eval latest=case($SearchOption$ == "Last_Working_Day" AND lower(strftime(now(),"%A"))="monday","-3d@s", $SearchOption$=="Last_Week_Same_Day_Time","-7d@s", $SearchOption$=="Last_Working_Day","-1d@s") | table earliest, latest | format "" "" "" "" "" ""]

niketn · ‎12-25-2016

You can try the following two options. Query 1 should work instantly, however for query 2 you need to create 2 knowledge objects i.e. Field Alias and Calculated Fields. Option 2 is recommended as that would eventually lead to easy maintenance and reuse of Splunk Search queries. Option 1 - Simple but without the use of Splunk Knowledge Objects If you do not want to create an Alias, you can do the same directly at Search time in Splunk. index=personnelIndex OR index=accountNameIndex (account_name=* OR personnel=*) | rename personnel as Account_Name | rename account_name as Account_Name | eval Account_Name=ltrim(Account_Name,"0") | stats count as MatchCount values(sourcetype) as Sourcetypes by Account_Name | search Sourcetypes="splunk_answers_483591_account" MatchCount=1 PS: 1. ltrim is used to remove leading zeros. 2. If possible you should be using source or sourcetype or host also in your base filter query to reduce the number of events filtered upfront(which will improve the performance of your search query). Option 2 - With the use of Splunk Knowledge Objects - Field Alias and Calculated Fields Ideally this is the use case for creating a Field Alias and Calculated fields Splunk Knowledge Objects, which will allow easy maintenance and re-usability with less code. If you can distinguish personnelIndex and accountNameIndex based on either one of source, sourcetype or host, you can create a field alias (so that same field name can be used for both indexes). Also you can create a Calculated Field for account_name to trim leading zeros using ltrim SPL command. For example you can create FIELDALIAS-account_name alias for personnelIndex index using either one of its sourcetype, source or host i.e. personnel AS account_name, which will create a search time field account_name in personnelIndex search as well. You also need to create EVAL-account_name Calculated field for accountIndex using either one of its sourcetype, source or host i.e. ltrim(account_name,"0"). This will remove leading zeros from account_name field. Following is the snippet from props.conf once you create the knowledge objects (add your sourcetype/host/source segment as per your use case). [<your_sourcetype_personnel>l] FIELDALIAS-account_name = personnel AS account_name [<your_sourcetype_account>] EVAL-account_name = ltrim(account_name,"0") Following is the query once above knowledge objects created: index=personnelIndex OR index=accountNameIndex account_name=* | stats count as MatchCount values(index) as IndexNames by account_name | search IndexNames="accountNameIndex" MatchCount=1

niketn · ‎12-25-2016

Ideally you should have asked a separate question. However, in any case, what you need is eval to set token based on condition. You can evaluate if the current day is Monday or not to set Last working day to previous day or 3 days prior. <eval token="option">case($selOption$=="Last_Week_Same_Day" AND strftime(now(),"%A")=="Monday","earliest=-3d@d latest=-3d@s",$selOption$=="Last_Week_Same_Day" AND strftime(now(),"%A")!="Monday","earliest=-1d@d latest=-1d@s", $selOption$=="Last_Working_Day" ,"earliest=-7d@d latest=-7d@s"</eval> Following is an example, however, please note that it is in 6.5 which uses init tag to initialize the token for first time load. The same is not available in previous version, so you might need to change as per your need. <form> <label>Sample Dashboard eval to set token</label> <init> <eval token="option">case(strftime(now(),"%A")=="Monday","earliest=-3d@d latest=-3d@s", strftime(now(),"%A")!="Monday","earliest=-1d@d latest=-1d@s"</eval> </init> <fieldset submitButton="false" autoRun="true"> <input type="radio" token="selOption" searchWhenChanged="true"> <label>Overlay Options</label> <choice value="Last_Working_Day">Last Working Day</choice> <choice value="Last_Week_Same_Day">Last Week Same Day</choice> <change> <eval token="option">case($selOption$=="Last_Week_Same_Day" AND strftime(now(),"%A")=="Monday","earliest=-3d@d latest=-3d@s",$selOption$=="Last_Week_Same_Day" AND strftime(now(),"%A")!="Monday","earliest=-1d@d latest=-1d@s", $selOption$=="Last_Working_Day" ,"earliest=-7d@d latest=-7d@s"</eval> </change> <default>Last_Working_Day</default> </input> </fieldset> <row> <panel> <title>Option: $option$</title> <chart> <search> <query>index=_internal sourcetype=splunkd log_level=error earliest=-0d@d latest=-0d@s | timechart count as Today | appendcols [ search index=_internal sourcetype=splunkd log_level=error $option$ | timechart count as $selOption$ ]</query> <sampleRatio>1</sampleRatio> </search> <option name="charting.chart">line</option> </chart> </panel> </row> </form>

niketn · ‎12-24-2016

While I am not aware of limits for use of NOT, following two points should always be considered: 1) For search performance avoid using NOT, since inclusion is better than exclusion. http://docs.splunk.com/Documentation/Splunk/6.5.1/Search/Writebettersearches#Avoid_using_NOT_expressions_when_possible 2) Both NOT and != are used to exclude results from search, however behavior is different for both. http://docs.splunk.com/Documentation/Splunk/6.5.1/Search/NOTexpressions

niketn · ‎12-24-2016

Would it possible for you to turn on KV mode as XML to extract search time field extraction. KV_MODE=xml If not you might have to try xpath or spath SPL command. Once you feed XML data as a field to xpath or spath, you can define the xml path for field extraction. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath

niketn · ‎12-24-2016

Option 1 You can use eval tag to use case expression and set a token <eval token="selTime">case($selYear$=="All" AND $selMonth$=="All","1y",$selYear$!="All" AND $selMonth$=="All","1mon",1==1,"1d")</eval> Option 2 You can define lookup to map various Year Month combination to select span Year,Month,Span All,All,1y 2017,All,1mon 2016,All,1mon 2015,All,1mon Anything that does not match Month=All can be defaulted as span=1d in your search.

niketn · ‎12-24-2016

I think plotting of 100 data points on x-axis is would not be possible unless you reduce browser text size to 90% or 85% or more or maybe display up to 85 data points on x-axis. You can try some charting properties to accommodate as many data points as possible: <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">-90</option> <option name="charting.axisLabelsX.majorLabelVisibility">show</option> <option name="charting.axisX.includeZero">true</option> You can also explore Punchcard custom visualization which can plot the 100 series data in x-axis (offers 45 degree rotation for labels)

niketn · ‎12-24-2016

Since you will be overlaying a lot of events in single chart using correlation method, you must ensure you are filtering only the required events upfront. For overlaying older data only till current time you can snap to current time using @s. Following are some of the ways to achieve the same: Option 1 Try using appendcols if all your series has similar data. Notice each search is essentially the same but with different earliest and latest time for three series namely Today (-0d), Yesterday (-1d) and last month (-1mon) index=_internal sourcetype=splunkd log_level=error earliest=-0d@d latest=-0d@s | timechart count as Today | appendcols [ search index=_internal sourcetype=splunkd log_level=error earliest=-1d@d latest=-1d@s | timechart count as Yesterday ] | appendcols [ search index=_internal sourcetype=splunkd log_level=error earliest=-1mon@d latest=-1mon@s | timechart count as LastMonth ] Option 2: Use append to correlate events similar to the one above, however, bin has to be adjusted manually to overlap time on x-axis i.e yesterday will require a correction to time by 1day= 24hour * 60min * 60sec= 86400. Refer to the following blog on using append to achieve the same :http://blogs.splunk.com/2012/02/19/compare-two-time-ranges-in-one-report/ Option 3: If you are using Splunk 6.5 onward you can try timewrap command where you can a lot of variations for timescale selection like timechart with daily, weekly, monthly comparison etc. Option 4. For Older Splunk versions you can check out Timewrap app on Splunkbase which does something similar. https://splunkbase.splunk.com/app/1645/

niketn · ‎12-23-2016

You can try strptime time specifiers and add a timezone (%z is for timezone as HourMinute format HHMM for example -0500 is for US Eastern Standard Time and %Z for timezone acronym for example EST is for US Eastern Standard Time.). However final result displayed will be based on Splunk Server time or User Settings. So if that suffices your need, instead of changing the timezone of the extracted field, you can modify the same through Logged in user's Account Settings in Splunk. https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables Option 1 | makeresults | eval Time="20161222221600" | eval TimeZone=Time+" -500"| eval FormatTime=strftime(strptime(TimeZone,"%Y%m%d%H%M%S %z"),"%Y/%m/%d %H:%M:%S %z") | Option 2 | makeresults | eval Time="20161222221600" | eval TimeZone=Time+" -EST"| eval FormatTime=strftime(strptime(TimeZone,"%Y%m%d%H%M%S %Z"),"%Y/%m/%d %H:%M:%S %Z") | Option 3 Account Settings in Splunk to change Global Timezone to EST.

niketn · ‎12-23-2016

You can try exploring Lookup File Editor App on Splunkbase it is not Splunk Certified or Supported however, the app is supported on Splunk Enteprise version 6.1 through 6.5. This app will allow you to edit and save CSV as lookup table to Splunk similar to the way Excel is used.

niketn · ‎12-23-2016

You can run outputlookup as daily scheduled command to write to excel as CSV or KV Store to be updated daily after midnight. Refer to the documentation on outputlookup: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputlookup

niketn · ‎12-23-2016

Here is an example to load Top 5 sourcetypes. Default and static choice value All may not be required. I have just added as example. <form> <label>Example Dashboard with Sourcetype Check Boxes</label> <fieldset submitButton="false"> <input type="time" token="selTime" searchWhenChanged="true"> <label>Select Time</label> <default> <earliest>-60m@m</earliest> <latest>now</latest> </default> </input> <input type="checkbox" token="chkSourceType" searchWhenChanged="true"> <label>Source Types</label> <choice value="*">All</choice> <prefix>sourcetype=</prefix> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <fieldForLabel>sourcetype</fieldForLabel> <fieldForValue>sourcetype</fieldForValue> <search> <query>index=_internal earliest=$selTime.earliest$ latest=$selTime.latest$ |top 5 sourcetype | fields sourcetype</query> </search> <default>*</default> </input> </fieldset> <row> <panel> <chart> <search> <query>index=_internal status=* $chkSourceType$ | stats count by status</query> <earliest>$selTime.earliest$</earliest> <latest>$selTime.latest$</latest> </search> <option name="charting.chart">line</option> </chart> </panel> </row> </form>

niketn · ‎12-22-2016

You would need to use eval tags for your calculations using relative_time SPL function. Either on current dashboard or your link workload_drilldown you would need to have time tokens earliest and latest (these are default fields if you have not created your own explicit time token). I have created a sample for for one of the scenarios so that you can use the eval tokens as per your needs. <drilldown> <eval token="EarliestTime">relative_time($click.value$,"-10m")</eval> <eval token="LatestTime">relative_time($click.value$,"+5m")</eval> <link> workload_drilldown?earliest=$EarliestTime$&latest=$LatestTime$ </link> </drilldown>

niketn · ‎12-22-2016

If you have uploaded the file to "C:\Program Files\Splunk\etc\apps\search\appserver\static", then your img tag should have the following code: <img src="/static/app/search/my_logo.png"> PS: When you add any static file to your Splunk app, you would need to restart Splunk and also delete browser history based on whether your browser's caching is enabled or not to reflect the change. For reference, you should also explore the Image Overlay With Single Value example from Splunk 6.x Dashboard Example app.

niketn · ‎12-22-2016

I copied your data twice to a dummy log file and modified time to mark separate events. I was able to get two events just by adding BREAK_ONLY_BEFORE condition on top of SHOULD_LINEMERGE=true [modsec_audit] SHOULD_LINEMERGE=true NO_BINARY_CHECK=true BREAK_ONLY_BEFORE=--d021db15-A-- Please let me know if this is what you expect.

niketn · ‎12-22-2016

Relative Timeframe for previous 2 hours should work as selected. However if you want to force the time window on your search you can add the same to your base search as well... <Your Base Search> earliest=-2h latest=now | <Your remaining Search>

niketn · ‎12-19-2016

Transaction is just one of several event correlation mechanisms that SPL offers. However, application of transaction is use case specific. You can choose between stats, joins, append, appendcols, lookup, transaction, sub-query. Refer to following documentation on choosing between various correlation mechanisms. http://docs.splunk.com/Documentation/Splunk/6.5.1/Search/Abouteventcorrelation In your case transaction is dropping events because there are too many events to correlate. You can add keepevicted=true however, query performance will degrade as Splunk will not mark any event as orphaned unless search completes. In your case stats might work out better. Try to provide the sourcetypes in base search so that events are brought together and then aggregate based on your common fields. If you can provide sample or mocked data example from both sources then, we would be able to assist you further.

niketn · ‎12-19-2016

You can add just a single data file to see preview. When you are adding multiple files you have to Turn Preview Data on. In any case, if it has worked once for you on any machine, all you are interested in, is exporting the props.conf file with the properties. Based on the name of the sourcetype you have selected. By default in your case it was [csv] however you can create any custom sourcetype like [mycustomcsv]. All you would need is to add the following properties to the props.conf file, under specific sourcetype, manually if you can't do the same through preview mode. TIME_FORMAT=%m/%d/%Y TIMESTAMP_FIELDS=Event_Date Like I had mentioned it would be most effective if you can ingest the data the way you want rather than modify things afterwards in the SPL.

niketn · ‎12-19-2016

Can you first check whether Real-Time searches are the culprit for memory issue or not? Also check whether it helps if you disable Fire Fox Browser caching.

niketn · ‎12-19-2016

Since you are getting performance counter for your disc utilization, should n't you always be trying to read only the single latest event? Assuming your inbound data arrives every 10 minutes. index=abc source=disk host=$host$ earliest=-10m@m | head 1 | eval totalGB = round(TotalSpaceKB/(1024*1024),0)| stats values(totalGB) as totalGB

niketn · ‎12-19-2016

You can create your own search time field extraction for Starting IPv4 firewall with iptables and Stopping IPv4 firewall with iptables as Status = Starting or Status=Stopping. You can do the same through rex, erex or interactive field extraction in Splunk during search time through Extract new fields. You can also do the same through props.conf. Would it be possible for your to share couple of example events?

niketn · ‎12-19-2016

Yes refresh.auto.interval is deprecated. However, I was asking for the attributes which have been newly introduced in Splunk 6.5 version: <refresh> <refreshType> http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/PanelreferenceforSimplifiedXML#search Realtime searches can put a load on any browsers not just Firefox. It is CPU/Memory intrinsic operation. Refer to documentation below: https://docs.splunk.com/Documentation/Splunk/6.5.1/Search/Realtimeperformanceandlimitations Moreover, I just wanted to be sure whether the hanging issue is because of Real Time Searches or not. You can try removing real time searches and see if you still face the issue with Panel/Dashboard refresh, whichever suits your needs. If you find that your browser is actually freezing due to real-time searches and not something else, then you can think of taking the next steps of designing properly for real time searches, in case you ablsolutely need it.

niketn · ‎12-19-2016

Use the following sample, which uses condition match case to identify whenever * is selected from dropdown. By Default the drilldown value is all (*). This example will show Pie Chart when All is selected using chart depends and single value when a single sourcetype is selected using chart rejects. PS: You should use match case with "*" instead of "*" <form> <label>Splunk Answers Switch between Chart types based on Drop Down Value</label> <fieldset submitButton="false"> <input type="dropdown" token="selSourceType" searchWhenChanged="true"> <label>Select Source Type</label> <choice value="*">All</choice> <search> <query>index=_internal earliest=-15m latest=now | dedup sourcetype| sort sourcetype | table sourcetype</query> </search> <fieldForLabel>sourcetype</fieldForLabel> <fieldForValue>sourcetype</fieldForValue> <change> <condition match="$value$=="*""> <set token="show_piechart">true</set> </condition> <condition> <unset token="show_piechart"></unset> </condition> </change> <default>*</default> </input> </fieldset> <row> <panel>  <chart depends="$show_piechart$"> <search> <query>index=_internal sourcetype="$selSourceType$" | stats count by sourcetype</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">pie</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> </chart>  <single rejects="$show_piechart$"> <search> <query>index=_internal sourcetype="$selSourceType$" | stats count by sourcetype</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="drilldown">none</option> <option name="numberPrecision">0</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="unitPosition">after</option> <option name="useColors">0</option> <option name="useThousandSeparators">1</option> </single> </panel> </row> </form>

Posts	6912
Solutions	1166
Karma Given	832
Karma Received	2453
Member Since	‎03-09-2015

How to avoid un-responsive dropdown input with 100...

How to enable drilldown from the Horizon Chart vis...

How can we create Tabs using Link List in Splunk w...

Splunk Add On builder not working on Mac but on Wi...

How to enable drilldown from the Outlier Chart vis...

[BUG] Built in token $message$ for <fail> Search E...

How do you make a table that reduces in height whe...

What is the expected behavior for Submit button wh...

App Certification criteria: I need help on the 64...

Parallel Coordinates Example has been named Locati...

Re: How to aggregate sequences of consecutive even...

Re: How to set value for earliest and latest?

Re: How to set value for earliest and latest?

Re: How to find missing values from two different ...

Re: How to build a trend chart that compares today...

Re: Is there any limit for the "NOT" operator?

Re: When creating a field extraction, why am I una...

Re: how can i match 2 conditions while setting tok...

Re: How to get a column chart to show all x-axis l...

Re: How to build a trend chart that compares today...

Re: How to convert date and time in UTC to EST?

Re: In Splunk, is it possible for users to write a...

Re: What is the best way to index snapshot type da...

Re: How to create a dynamic selection of sources i...

Re: How to modify the timerange token in drilldown...

Re: How do I simply insert an image into a dashboa...

Re: How to edit props.conf to line break modsecuri...

Re: Why does my alert run for an "All time" time r...

Re: Is the Transaction command suitable for large ...

Re: How to edit my search to filter events based o...

Re: Why does Splunk dashboard Javascript cause Fir...

Re: Why does my single panel show the incorrect am...

Re: How can I include queried text string in a tab...

Re: Why does Splunk dashboard Javascript cause Fir...

Re: How to hide single value panel based on a drop...

Join the Conversation